Getting Data In

Is it possible to re-index lost AD logs?

dantimola
Communicator

Good Day fellow splunkers,

I just like to ask if is it still possible to re-index lost Windows Active Directory logs? Let's say, AD logs from a month a go. The reason why the logs lost is probably because of network issue. Please check my inputs.conf below.

[admon://default]
disabled = 0
monitorSubtree = 1
index = ad

Cheers,
Dan

0 Karma
1 Solution

DalJeanis
SplunkTrust
SplunkTrust

Okay, the answer depends on what you mean by "lost", and what you mean by "reindex".

If the log never got to splunk, but a copy is somewhere else that you can access, then YES. (search "manual load data")

If the log never got to splunk, and is not somewhere else that you can access, then NO.

If the log got to splunk, was indexed or went to the null queue, and the incoming log file was sent to oblivion and was not backed up, then NO. You got what you got.

If the log got to splunk, was indexed correctly or incorrectly, and the system is set up to move ingested files to a backup location, then YES. (Search for "reindex data")

If the log got to splunk, was indexed correctly, then got frozen and rolled off and you want it loaded back in, then YES. (Search for "reload frozen")

View solution in original post

0 Karma

DalJeanis
SplunkTrust
SplunkTrust

Okay, the answer depends on what you mean by "lost", and what you mean by "reindex".

If the log never got to splunk, but a copy is somewhere else that you can access, then YES. (search "manual load data")

If the log never got to splunk, and is not somewhere else that you can access, then NO.

If the log got to splunk, was indexed or went to the null queue, and the incoming log file was sent to oblivion and was not backed up, then NO. You got what you got.

If the log got to splunk, was indexed correctly or incorrectly, and the system is set up to move ingested files to a backup location, then YES. (Search for "reindex data")

If the log got to splunk, was indexed correctly, then got frozen and rolled off and you want it loaded back in, then YES. (Search for "reload frozen")

0 Karma
Get Updates on the Splunk Community!

Observability | How to Think About Instrumentation Overhead (White Paper)

Novice observability practitioners are often overly obsessed with performance. They might approach ...

Cloud Platform | Get Resiliency in the Cloud Event (Register Now!)

IDC Report: Enterprises Gain Higher Efficiency and Resiliency With Migration to Cloud  Today many enterprises ...

The Great Resilience Quest: 10th Leaderboard Update

The tenth leaderboard update (11.23-12.05) for The Great Resilience Quest is out >> As our brave ...